ACPI: CPPC: Avoid out of bounds access when parsing _CPC data in Kernel
Summary
GSD-2022-1001426: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data. Affects Kernel versions >= 337aadff8e4567e39669e07d9a88b789d78458b5, < b80b19b32a432c9eee1cd200ef7aaddf608f54d1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential services and manages system resources. ACPI (Advanced Configuration and Power Interface) is a standard for power management and hardware configuration on modern systems. The CPPC (Collaborative Processor Performance Control) is a feature of ACPI that allows the operating system to communicate with the processor to optimize performance and power consumption. However, a vulnerability has been identified in the Kernel's ACPI CPPC implementation that could lead to out of bounds access when parsing _CPC data.
Vulnerability Detail
The vulnerability in the ACPI CPPC implementation of the Kernel allows for out of bounds access when parsing _CPC data. This could potentially be exploited by an attacker to gain unauthorized access or execute arbitrary code on the affected system. The vulnerability was introduced in version v4.4 of the Kernel and has been fixed in version v5.16.19. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The ACPI CPPC vulnerability in the Kernel could potentially allow for unauthorized access or arbitrary code execution. It is important to update the Kernel to version v5.16.19 or later to fix this vulnerability. Regularly updating the Kernel is crucial to ensure the security and stability of the system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it could potentially allow an attacker to gain unauthorized access or execute arbitrary code on the affected system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any open-source vulnerabilities, including this one.
Yes, a patch has been released in version v5.16.19 of the Kernel. It is recommended to update to this version or later to fix the vulnerability.
Updating the Kernel is the recommended way to mitigate the risk associated with this vulnerability. However, if updating is not feasible, you can consider implementing additional security measures such as network segmentation, access controls, and intrusion detection systems to minimize the potential impact.
You can find more information about this vulnerability in the GSD-2022-1001426 JSON report available on the Cloud Security Alliance's GSD database (https://github.com/cloudsecurityalliance/gsd-database).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
